Not all traffic can be fraudulent. However, this is a fast install, which could be a genuine user who has gone through an optimised flow. A low rejection rate may indicate clean traffic or could be a test of something else.
To understand the underlying data and understand the context of what is happening, we looked at 2.55 billion attribution events over 3 months to understand the real reasons behind the rejections, the likely types of app install fraud we’d see in 2026, and what good quality traffic should look like. Our key learnings were;
- 7.48% of installs were rejected
- 7.5× more Android SDK spoofing volume than iOS
- 47.71% rejection rate for sub-10-second installs
- 59.5% blended rejection rate across six high-rejection partners
What Does the Data Reveal About App Install Fraud in 2026?
There is no one signal to detect all app install fraud and fraud is not evenly spread. Looking further into the rejection reasons, we saw that 21.8% of rejections were due to SDK spoofing and 11% were due to blacklisted IP’s. The largest category was General Rejected-installs at 59%; this is because knowing if an install is invalid is a different issue.
Even Android and iOS differ. SDK spoofing was a larger cause of Android rejections (25.9%) vs iOS (9.9%). Blacklisted IPs mirrored this trend with 16.2% of rejections on Android and 7.2% on iOS.
Why Isn’t One Fraud Signal Enough?
Looking at CTIT, we can see that installs that happened within 10 seconds of click are around 6.4x higher than the overall rate. 47.71% of installs were rejected.
However, this could also be seen in valid traffic. We saw one instance of a single deep link implementation with 4,908 events within the under-10-second window but only 0.04% were rejected. Whilst a fast install will show you where to look, it won’t tell you what you’ll find.
The takeaway is simple:
A signal can tell you what to investigate. It doesn’t always tell you what to conclude.
Where Does Traffic Quality Break Down?
When looking at the individual partners, we can see that the 6 highest rejecting partnerships had a total of 1.73 Million events with 59.5% being rejected. One large programmatic source had 37.6 million events with only 4.08% being rejected.
This shows why it’s important to look at your source and partner-level data to help with attributing and preventing app install fraud. Averaging out the data will hide the damage being caused by the partners.
What’s Inside the Report?
The full report explores:
- App Install Fraud in Attribution Data – What it looks like and how it impacts.
- Differences between Android and iOS SDK Spoofing signals.
- Short CTIT – Context required.
- Rejection rates per supply partner and what this tells us about the quality of traffic.
- Multiple signals can give us more information.
- Areas of missing measurement mean interpretation of the app install fraud can be more complex.
Get the Data Behind the Signal
This report is built on Apptrove’s analysis of 2.55 billion attribution events. It gives app marketers a closer look at the traffic that gets rejected and explains what sits behind those rejections. You will see how different fraud signals show up on Android and iOS, how click-to-install time should be read alongside other data, and how rejection rates vary from one supply partner to another.
Marketers can use these findings to check their own app install fraud detection setup and to question assumptions they may have made about traffic quality. If you run paid campaigns across several partners, the partner-level breakdown is a good place to start, because it shows how much a blended average can hide.
Download the White Paper
Go beyond the fraud signal. Understand the pattern.
Data is based on production attribution data from Apptrove in the last 3 months of 2026. Rejection categories are based on our own taxonomy of rejections. Partner names have been anonymised.
